Description
SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.
Published: 2025-03-20
Score: 8.8 High
EPSS: 2.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-6842 SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.
History

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00274}

 epss

{'score': 0.00338}

Mon, 14 Jul 2025 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Superagi
Superagi superagi
CPEs cpe:2.3:a:superagi:superagi:0.0.14:*:*:*:*:*:*:*
Vendors & Products Superagi
Superagi superagi

Thu, 20 Mar 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Mar 2025 10:15:00 +0000

Type Values Removed Values Added
Description SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.
Title Remote Code Execution in transformeroptimus/superagi
Weaknesses CWE-94
References
Metrics cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Superagi Superagi
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2025-03-20T18:19:47.040Z

Reserved: 2024-10-02T17:24:06.296Z

Link: CVE-2024-9439

cve-icon Vulnrichment

Updated: 2025-03-20T17:49:51.370Z

cve-icon NVD

Status : Analyzed

Published: 2025-03-20T10:15:49.077

Modified: 2025-07-14T20:16:31.710

Link: CVE-2024-9439

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses